Veeam Backup & Replication: Arbitrary file read by Cloud Connect tenants
Summary
An authenticated Veeam Cloud Connect tenant can read arbitrary files on the service provider host running Veeam Backup & Replication. The flaw is a path traversal (CWE-22) with a CVSS 4.0 score of 8.3 (High) and mainly affects confidentiality. The attack requires a valid tenant login but no user interaction, so any tenant account on the provider host is a potential attack source.
Affected
- Veeam Backup & Replication 12 up to and including 12.3.2.4854 (and earlier 12 builds)
- Veeam Backup & Replication 13 up to and including 13.0.2.29 (and earlier 13 builds)
- Windows-based Veeam Backup & Replication deployments
- Unsupported versions were not tested but are likely affected
- Note: the affected range in the CVE record and aggregators (13 up to 13.0.3) differs from the vendor text. Builds 13.0.2.29 to 13.0.3.63 are treated as vulnerable until Veeam clarifies.
Fixed in
- Veeam Backup & Replication 13.1 (build 13.1.0.411)
- Veeam Backup & Replication 13.0.3 (build 13.0.3.63)
- Veeam Backup & Replication 12.3.2 P4 (build 12.3.2.4934)
Workaround
Unknown. Veeam has published no workaround. An aggregator suggests restricting Cloud Connect tenant file access to the tenant's own directories, but this is not confirmed by Veeam and is only a temporary stopgap.
Exploitation
- No evidence of in-the-wild exploitation found.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- EPSS score 0.0037.
- No public proof of concept found in a brief search; this does not rule one out.
Our recommendation
- Identify Veeam Backup & Replication servers with the Cloud Connect role and confirm their versions. If you do not run Cloud Connect as a service provider, you are not exposed to this flaw.
- Upgrade to 13.1.0.411, 13.0.3.63 or later, or 12.3.2.4934 or later, and install the other October 2026 Veeam fixes at the same time.
- Until patched, review Cloud Connect tenant accounts and restrict their file access where possible.
- Monitor the Veeam advisory KB4902 for clarification of the 13.0.3 build range.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Veeam KB4902: Vulnerabilities Resolved in Veeam Backup & Replication 13.1 www.veeam.com
- Veeam KB3103: Fix list www.veeam.com
- Veeam KB4696: 12.3 release notes www.veeam.com
- VulDB entry for CVE-2026-58069 vuldb.com
- Heise: Veeam closes vulnerability in Backup & Replication www.heise.de
- OpenCVE: CVE-2026-58069 app.opencve.io
- Vulners: NVD:CVE-2026-58069 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:01.
Original description (NVD)
This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.